turbo.json

{
	"$schema": "https://turborepo.dev/schema.json",
	"ui": "tui",

	"globalEnv": ["NODE_ENV"],

	/**
	 * Turborepo hides environment variables from tasks unless they are declared,
	 * and the failure is silent: the build succeeds having read `undefined`.
	 *
	 * That is not hypothetical here. `API_URL` was stripped from the Next.js
	 * build, so the browser bundle was compiled with the localhost fallback and
	 * every request from a deployed page went to the reader's own machine; and
	 * `DATABASE_URL` was stripped from the agent build, where `eve build`
	 * evaluates the authored modules and `@crm/db` throws without it. The
	 * `MICROSOFT_*` trio was the same omission again: undeclared, so
	 * `microsoftCredentials()` read nothing, `isMicrosoftConfigured()` was
	 * false, and the sign-in page dropped the Microsoft button with no error
	 * anywhere. A configured `MICROSOFT_TENANT_ID` was ignored the same way.
	 *
	 * `globalPassThroughEnv` is the right list for all of them, because none
	 * change what a build *produces* — they are read at runtime, or inlined from
	 * the separately-declared public copy — so they must not become part of the
	 * cache key. A secret in the cache key means a cache miss every rotation and
	 * a secret in the cache metadata.
	 *
	 * `TEST_DATABASE_URL` is here for the same reason and learned the same way.
	 * `NODE_ENV` is in `globalEnv`, so `bun test` sets it to `test` in every
	 * package, and `@crm/db` then demands the test database and refuses to fall
	 * back. Undeclared, it was stripped from every test task — so the suite went
	 * red on a machine that had the variable set, complaining it was not set.
	 * Locally it passed throughout, because `@crm/env/load` reads the root `.env`
	 * from disk and CI has no such file.
	 */
	"globalPassThroughEnv": [
		"DATABASE_URL",
		"DATABASE_URL_UNPOOLED",
		"TEST_DATABASE_URL",
		"TEST_RUN_ID",
		"BETTER_AUTH_SECRET",
		"BETTER_AUTH_URL",
		"ALLOWED_SIGN_IN",
		"GOOGLE_CLIENT_ID",
		"GOOGLE_CLIENT_SECRET",
		"MICROSOFT_CLIENT_ID",
		"MICROSOFT_CLIENT_SECRET",
		"SLACK_CLIENT_ID",
		"SLACK_CLIENT_SECRET",
		"MICROSOFT_TENANT_ID",
		"AUTH_COOKIE_DOMAIN",
		"CRON_SECRET",
		"REDIS_URL",
		"CACHE_TTL_MS",
		"PORT",
		"PRISMA_LOG_QUERIES",
		"PERPLEXITY_API_KEY",
		"RAPIDAPI_KEY",
		"GITHUB_TOKEN",
		"BLOB_READ_WRITE_TOKEN",
		"AI_GATEWAY_API_KEY",
		"VERCEL_OIDC_TOKEN",
		"AGENT_URL",
		"AGENT_BRIDGE_SECRET",
		"CRM_TELEMETRY_DISABLED",
		"DO_NOT_TRACK",
		"VERCEL",
		"VERCEL_GIT_COMMIT_SHA"
	],

	"tasks": {
		"topo": {
			"dependsOn": ["^topo"]
		},
		"build": {
			"dependsOn": ["^build"],
			/**
			 * These two *are* cache keys, because they are inlined into the
			 * browser bundle at build time — the same source compiled against a
			 * different `API_URL` is a different artefact, and reusing a cached
			 * one would ship the wrong origin.
			 */
			"env": ["API_URL", "APP_URL", "NEXT_PUBLIC_API_URL"],
			"inputs": ["$TURBO_DEFAULT$", ".env*"],
			"outputs": [
				".next/**",
				"!.next/cache/**",
				"!.next/dev/**",
				"dist/**",
				".output/**"
			]
		},
		"lint": {
			"dependsOn": ["topo"]
		},
		"check-types": {
			"dependsOn": ["topo", "^build"]
		},
		"test": {
			"dependsOn": ["topo", "^build"]
		},
		"dev": {
			"dependsOn": ["^dev:prepare"],
			"cache": false,
			"persistent": true
		},
		"dev:headless": {
			"dependsOn": ["^dev:prepare"],
			"cache": false,
			"persistent": true
		},
		"dev:prepare": {
			"cache": false
		}
	}
}